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Amendments to the Claims : 

This listing of claims replaces all prior versions and listings of claims in the application: 
Listing of Claims : 

1 . (Currently Amended) A method for classifying by means of a computing system, 
connections detected between senders and receivers in communication networks which use 
protocols, each named by a usable protocol name, charact e riz e d in that wherein in the computing 
system: 

-associated with each usable protocol name is a protocol s e lfid e ntifi er self-identifier 
mechanism devised [so as]to recognize determinant information of the protocol named by this 
name, from among information conveyed in a detected connection[[,]]; 

associated with each so-called father protocol usable protocol name is a non empty or 
empty list of so-called son protocol usable protocol names[[,]]; 

with each connection detected, a computing kernel associates [(1002, 1003)]a first data 
structure devised [[so as]]to contain an ordered sequence of used protocol names which is 
initialized with a so-called base protocol name[[,]]; 

for each connection detected, the computing kernel constructs [(1004)]the first data 
structure by searching [(2000)]through the list of son protocol names, associated with the last 
name of said ordered sequence, for a son protocol name for which the associated [s e lfid e ntifier ] 
self-identifier mechanism recognizes [(2002, 2007)] determinant information from among the 
information conveyed and then by appending [(2003)]to the end of the ordered sequence, the son 
protocol name when it is found and by starting to search again so long as it is possible to find 
[(2009)] in the list of son protocol names, associated with the last name of said ordered sequence, 
a son protocol name for which the associated s e lfid e ntifi e r self-identifier mechanism recognizes 
determinant information from among the information conveyed[[,]]; and 

the computing kernel declares [(2010)]classified the connection detected when it is no 
longer possible to find in the list of son protocol names, associated with the last name of said 
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ordered sequence, a son protocol name for which the associated s e lfid e ntiti e r self-identifier 
mechanism recognizes determinant information from among the information conveyed. 

2. (Currently Amended) The method for classifying connections as claimed in claim 1, 
charact e riz e d in that wherein to search for a son protocol name, the computing kernel submits 
[(2006)]the information conveyed, to each s e lfid e ntifi e r self-identifier mechanism associated 
with a name from the list of son protocol names until one of the s e lfid e ntifi e r self-identifier 
mechanisms declares [(2007)]recognition of determinant information or until no s e lfidentifi e r 
self-identifier mechanism can declare recognition [(20 12)]of determinant information. 

3. (Currently Amended) The method for classifying connections as claimed in claim 1, 
charact e riz e d in that wherein to search for a son protocol name, the computing kernel submits 
[(2002)]the information conveyed to the s e lfid e ntifi e r self-identifier mechanism associated with 
the last name of the ordered sequence, in such a way that this s e lfid e ntifi e r self-identifier 
mechanism finds the name of the son protocol among the determinant information of the father 
protocol. 

4. (Currently Amended) The method for classifying connections as claimed in on e of th e 
pr e c e dingjclaimG claim 1 , charact e rized in that wherein the computing kernel formulates 
[(1001)] a current signature for each connection detected, by submitting all or part of the 
information conveyed to at least one s e lfidentifi e r self-identifier mechanism associated with one 
of the names of low rank in said ordered sequence, in such a way that this s e lfid e ntifi e r self- 
identifier mechanism finds among the determinant information, source and destination indicators 
incorporated into said current signature by the computing kernel. 
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5. (Currently Amended) The method for classifying connections as claimed in claim 4, 
characteriz e d in that wherein the computing kernel catalogs each first data structure in a first 
table [[(l)]]by establishing a first associative correspondence between each first data structure 
and the current signature formulated [(1001)]for the associated connection. 

6. (Currently Amended) The method for classifying connections as claimed in claim 5, 
charact e riz e d in that wherein the computing kernel establishes [(1003 ,20 11)] in said first table 
[[(l)]]a second associative correspondence between each current signature and a peer signature 
whose source indicators are the indicators of destination of the current signature and whose 
destination indicators are the indicators of source of the current signature. 

7. (Currently Amended) The method for classifying connections as claimed in on e of 
Claims 5 and 6 claim 5 , characteriz e d in that wherein : 

the computing kernel gathers [(1000)] in data packets passing through the computing 
system within connections to be detected, the useful information conveyed so as to formulate a 
signature in such a way as to formulate [(1001)]the current signature whenever the useful 
information conveyed is sufficient, and 

the computing kernel uses the current signature thus formulated in real time 
to detect a connection, in such a way as to search [(1002)] in said first table [[(1)]], for the first 
data structure which corresponds to the current signature, to associate [(1003)] a new first data 
structure with the connection detected when there exists no first data structure which corresponds 
to the current signature and to start or continue [(2000)] to construct the first data structure when 
there exists a first data structure which corresponds [(1002)]to the current signature, by gathering 
[(1000)]in the data packets, the useful information conveyed so as to construct first data structure. 
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8. (Currently Amended) The method for classifying connections as claimed in claim 7, 
charact e riz e d in that wherein , when the useful information gathered in a data packet is not 
sufficient to formulate a signature, the computing kernel catalogs the useful information in a 
second table by establishing an associative correspondence between the useful information 
which then comprises links of membership to one and the same connection, until the useful 
information is sufficient to formulate the current signature. 

9. (Currently Amended) The method for classifying connections as claimed4n on e of th e 
pr e c e ding] claims claim 1 , charact e riz e d in that wherein : 

the computing kernel traverses [(1006)] the used protocol names of the ordered sequence 
in the data structure which it constructs so as to detect [(1007)]each dynamic connection protocol 
name, and 

for each dynamic connection protocol name detected, the computing kernel submits 
[(1008)] the information conveyed to the s e lfidentifi e r self-identifier mechanism associated with 
the name detected in such a way as to determine whether there exists a subsequent dynamic 
connection and if a subsequent connection exists, to associate therewith [(1009)] a second data 
structure devised so as to contain an ordered sequence of potential protocol names which begins 
with the so-called base protocol name. 

10. (Currently Amended) The method for classifying connections as claimed in claims 5 
and 9 claim 9 , charact e riz e d in that wherein the computing kernel formulates a current 
signature for each connection detected, by submitting all or part of the information conveyed to 
at least one self-identifier mechanism associated with one of the names of low rank in said 
ordered sequence, in such a way that this self-identifier mechanism finds among the determinant 
information, source and destination indicators incorporated into said current signature by the 
computing kernel the computing kernel catalogs each first data structure in a first table bv 
establishing a first associative correspondence between each first data structure and the current 
signature formulated for the associated connection, and the computing kernel catalogs [(1009)] 
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each second data structure in a second table [[(2)]]by establishing an associative correspondence 
between each second data structure and a potential signature formulated by the s e lfid e ntifi e r self- 
identifier mechanism associated with the name detected. 

1 1 . (Currently Amended) The method for classifying connections as claimed in claim 
10, charact e riz e d in that wherein the computing kernel furthermore constructs the first data 
structure: 

by searching [(2004)] for the ordered sequences of potential protocol names in which the 
ordered sequence of used protocol names is included, and 

when there exists [(2005)] an ordered sequence of potential protocol names whose 
potential signature corresponds to the current signature, by completing[ (2003)] the first data 
structure by means of the second data structure. 



